Subject: RE: [Isis-wg] MD5 Authentication Questions

From: Jon Berger <[email-masked]>
Date: Thu, 31 Jan 2002 10:07:26 -0000

I'm slightly confused.  Can you confirm that you are just talking about the
receive side?  

My reading of ISO10589 and draft-ietf-isis-hmac-03 is that the sender
 - constructs the LSP
 - calculates the authentication TLV (as described below)
 - calculates the checksum over the entire PDU including the authentication
TLV.

Is this correct?

Jon

-----Original Message-----
From: Tony Li [mailto:[email-masked]]
Sent: 31 January 2002 07:49
To: Suresh Boddapati
Cc: [email-masked]; [email-masked]
Subject: Re: [Isis-wg] MD5 Authentication Questions

Not all systems in a domain may support authentication because of migration
issues.  Thus, always providing the checksum is a good thing.

Tony

Suresh Boddapati writes:
 | What is the rationale behind making the checksum zero before computing
the 
 | authentication value and then computing the checksum over the entire
packet 
 | (including the authentication TLV)? Why not just leave it at zero, like
OSPF 
 | MD5 authentication does? If the computation of the authentication value
at 
 | both the sending and receiving ends dont match, isn't that enough to
discard 
 | the packet? On the other hand, if they do match, wont the checksum 
 | claculation always yield the same result at the sending and receiving end

 | thereby making checksum calculation and verification redundant?
 | 
 | Regards,
 | 
 | Suresh
 | 
 | >  | 2)What about the checksum? Is it left at zero since the
authentication 
 | >value
 | >  | itself can be used as a mechanism to detect packet corruption? In
other
 | >  | words, should the checksum field be always zero for MD5
authenticated
 | >  | packets? If not, is the checksum computed after adding the 
 | >authentication
 | >  | information to the LSP or before?
 | >
 | >
 | >Both values should be restored after computation.
 | >
 | >Tony
 | >_______________________________________________
 | >Isis-wg mailing list  -  [email-masked]
 | >http://external.juniper.net/mailman/listinfo/isis-wg
 | 
 | 
 | 
 | 
 | _________________________________________________________________
 | Send and receive Hotmail on your mobile device: http://mobile.msn.com
 | 
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg
_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg